State Data Deal with Media Should Alarm You

Thanks to KUOW’s article, State Deal to Give Media Organizations Student Data Alarms DSCN8580Privacy Experts, the deal the Office of the Superintendent of Public Instruction (OSPI) made to provide the Seattle Times with individual teacher and student level data has been exposed. This deal has alarmed more than just privacy experts. I predict it will alarm even more as people become aware, especially parents. If you are a student, parent, teacher, taxpayer, voter, or community member you should become alarmed as well.

OSPI will release individual staff and student data to the Seattle Times. The KUOW article says:

The Federal Family Educational Rights and Privacy Act, or FERPA, generally prohibits release of confidential student data without parental consent.

That may have been true about FERPA in the past. Without congressional approval or authorization, the U.S. Department of Education made substantial changes to FERPA regulations in 2011. Those regulation changes were made to enable these kinds of data deals without any requirements for parental consent or even notification. Even if this data deal is within the guidelines of the new FERPA regulations, morally and ethically is it a sound deal?

State government has way too much data on students. It has this data without active consent of parents. When was the state going to fully disclose this to parents or ask for their consent? I think it’s clear: Never.

The agreement itself has a clause in it that states:

Data provided by OSPI cannot be linked with other data or data sets as a way to determine the identity of individual students.

Nice clause, like so many other clauses in the agreement. Murder and theft are against the law yet both activities take place. Those illegal actions usually are noticed even if not solved. It is possible with this deal that data may get out of OSPI’s hands and the hands of the Seattle Times, matched to identify individuals and later used for purposes unintended by this nefarious data deal. And it is possible no one would notice or be able to attribute the matched data to OSPI or the Seattle Times.

When I shared KUOW’s article with Education Analyst Richard Innes of the Blue Grass Institute for Policy Solutions this is what he said:

This is a stunning and very disturbing development.

A newspaper can be expected to have, or be able to quickly assemble, a very rich database of information about individuals. If the data released to a newspaper has enough student demographic information in it, the paper could very likely reattach student names and ID’s to the data it gets from schools.

Such a match actually occurred in 1999 in a Lauress Wise report about Kentucky’s huge jump in exclusion of students on the 1998 National Assessment of Educational Progress (NAEP). While researching the possible impact of that exclusion jump, Wise reattached NAEP data to individual student data from Kentucky’s KIRIS assessments with an 86 percent positive match rate using only seven student data attributes. Just seven. The student identification had been stripped from the NAEP data, but that didn’t stop Wise.

file9791234819983While it sounds nice in this data deal that student identifiers, like names and SSN (why should the schools or states even have student SSNs), will be stripped from the data, it is meaningless except to placate an unknowing public. It is becoming increasingly easier to personally identify individuals through data matching. Richard’s quote gives an example of data matching using seven data points. I have read information indicating that three data points—age, gender, and zip code—has enabled data matchers to personally identify individuals accurately 87% of the time.

The KUOW article quotes Superintendent Banda of the Seattle Public Schools:

“Wow,” said Seattle Public Schools Superintendent Jose Banda. “I wasn’t aware of [this agreement], and I don’t think any of my staff was aware that this was being considered and approved.”

“This is really disconcerting for us, because we’ve been assuring families that we are really mindful about following [data privacy] rules,” Banda said.

This data deal agreement may actually be following the newly changed FERPA rules. file0001344599812That does not mean those rules or regulations are moral, ethical, or in the best interest of student privacy. Since Superintendent Banda finds this data deal to be disconcerting, he may want to examine and rethink a similar data deal that bears his signature: Amended Agreement Between Seattle Public Schools And The Community Center For Education Results Regarding Data Sharing for Research Studies. Supt. Banda’s predecessor brought the draft of this agreement into play but it does bear his signature.. Some may find it interesting to note that Mary Jean Ryan signed the agreement as the Executive Director of the Community Center for Education Results (CCER). Mary Jean is a former chair of the Washington State School Board of Education.

I find both data deal agreements to be disconcerting.

Fans of fabulously generous reform education funders will be happy to know this Seattle Times project and the CCER are funded by the Bill & Melinda Gates Foundation.

I find it interesting, if not deceiving, that parents are not informed about what happens with the data they provide the school. They are not told that, in essence, the state treats the data as its own property. Parents Need to Know About Student Data Privacy is one article that only scratches the surface in letting parents know about the information they provide to the schools.

file291303336275The data deal OSPI has made with the Seattle Times raises a lot of questions. The good citizens of Washington State may not ask any of those questions if they think the state acts in the best interest of the students and people of the state. The questions those good citizens may not ask may run along the lines of: Who authorized OSPI to gather and store student data to begin with? Who authorized OSPI to make such a data deal? Was it the legislature? Is it in the state constitution? Did parents authorize the sharing of their child’s data? At what point did parents authorize this—when they enrolled their child in school? Were parents informed beforehand that their child’s data may be shared with private for profit or non-profit organizations? Were parents asked for their consent? Who will benefit most from this? (yes, I know they say the data will help inform and improve instruction—this sounds nice yet I have not seen any evidence to back this up) If the current Superintendent of Public Instruction decides to run for a third term do you think this deal will have any influence on whether the Seattle Times supports, promotes, or endorses his campaign? That support, promotion, or endorsement could make a difference in the outcome of an election but I seriously doubt that was a discussion that took place in the brokering of this data deal. Would such a discussion even need to take place?

Are these kind of data deals only taking place in Washington State? If you live in another state you may want to see if your local school district or state department of education has made similar data deal agreements.

The legislative bill announced in A Bill to Look at Privacy Rights of Washington Students, if passed will be a much needed start in addressing and protecting the privacy rights of students.

A related article, Study Finds Large Gaps in Student Data Privacy Protection By Districts Using Cloud Services, will be of interest to those concerned about privacy issues related to student data.


This article is also posted on the Stop Common Core in Washington State website.

2 thoughts on “State Data Deal with Media Should Alarm You

  1. Maybe I missed something in the agreement between OSPI and the Seattle Times but it appears to me that confidential information WILL be given to the Seattle Times and it is up to the Times to keep it confidential. I haven’t read the agreement word for word but I saw nothing that indicated names and SSNs would be stripped.

    Below is a link to the “K-12 Data Feasibility Study Report” from January 2009. On Page 50 of the report is a description of “Research ID” which is what the Seattle Times requested. It appears to me that the Seattle Times will get everything BUT it has to protect the data and keep it confidential. So, all sorts of “conclusions” can be made by the journalists (who are NOT researchers) but they can’t publish identifying information. THEY can see the information though (at least that’s how it looks to me). Hackers will get all the information. Of course, they could also get that directly from OSPI.


    1. Beth,

      I agree with you. The way I read and interpret the
      agreement, there will be no need for concern about someone using the
      released data to do any data matching to identify individuals. The
      agreement provides for the release of individual identities.

      I am
      glad to see you are still tracking these issues. I hope you are also
      following the Stop Common Core in Washington State website.

Comments are closed.